8

I'm confused about the NETWORK SERVICE account (group?) works on network shares:

On one hand, NETWORK SERVICE is generally described as an account that's local to a given machine. (See, e.g., here on serverfault or in Microsoft's Access Control in IIS 6.0 document.) So it's not a domain-wide account. And, for instance, if a process running under NETWORK SERVICE on SERVERA tries to request a resource on SERVERB, the authentication won't be under some hypothetical MYDOMAIN\NETWORK SERVICE, but rather under MYDOMAIN\SERVERA$. (The latter is known as SERVERA's "computer account".)

On the other hand, I've noticed I can go to a remote file share where I have admin rights, and set permissions on a particular directory for NETWORK SERVICE. (e.g. I can go to \\MYSHARE in Windows Explorer, right-click one of the directories, go to Security > Edit > Add, type "NETWORK SERVICE" in the "Enter the object names to select" box and click OK. Now I have a new NETWORK SERVICE entry in the list of "Group or user names", and I can change the permissions for it, just like I might change permissions for the "Users" group.)

If NETWORK SERVICE is strictly a machine-by-machine account, I don't understand what is supposed to happen when I create a set of permissions for NETWORK SERVICE on a remote share. Does that entry refer to NETWORK SERVICE on one particular (unspecified) machine? To judge by the icon, the permissions are technically for a NETWORK SERVICE group, rather than than a NETWORK SERVICE user. But I can't seem to find any documentation for a NETWORK SERVICE group or how it might work compared to a regular domain group.

My only guess so far is that, if you grant access to the NETWORK SERVICE group (assuming there is such a thing), this amounts to granting access to all the "computer accounts" on the whole domain. (That is, giving permissions to NETWORK SERVICE on a central file server would be the same as giving permissions to MYDOMAIN\SERVERA$, MYDOMAIN\SERVERB$, MYDOMAIN\SERVERC$, ..., MYDOMAIN\MYLASTSERVER$.)

Improve this question
2
  • 1
    The title of the post is the question. But to to more specific, there's this thing that is possible (give permissions for something to NETWORK SERVICE), and the question is what that does, given that NETWORK SERVICE is a special account. I didn't have something in particular I was trying to accomplish; I was just curious if it might help me accomplish something in the future.
    – Chris
    Mar 24, 2013 at 18:29
  • Just because you can do something, it does not logically follow that it is ever useful to do so. (Although in this particular example, there may be a few edge cases.)
    – Harry Johnston
    Apr 12, 2013 at 5:54

1 Answer 1

Reset to default
7

NETWORK SERVICE is a well known account. It has the same SID on every machine. You are correct that NETWORK SERVICE on MachineA will not authenticate as NETWORK SERVICE on MachineB. It's not a group, it is an account.

It's very rare that you would be setting NETWORK SERVICE permission (share or NTFS) on a share. This would only be necessary if a service on the local machine, running under the credentials of NETWORK SERVICE, was trying to connect to that share on the local host.

When a service logging on as NETWORK SERVICE tries to connect to a remote machine the credentials of the local machine will be used. So if a service is running on MachineA in the domain example.com then that service would connect to MachineB as [email protected] (or example\MachineA if you like NetBIOS style names).

Improve this answer
3
  • To give an example that's hopefully correct: Say I'm on MYDOMAIN\MachineA and I navigate to \\MyFileServer\MyShare using Windows Explorer. Initially MyShare is read-only for everyone except Administrator. From MachineA I change the permissions of MyShare, granting write access to NETWORK SERVICE. What this actually does is give write permissions to the MYDOMAIN\MachineA$ account. Therefore, MachineA's NETWORK SERVICE can write to MyShare, but MachineB's (or MachineC's or ...) NETWORK SERVICE account can't write to MyShare.
    – Chris
    Apr 9, 2013 at 19:14
  • 2
    @Chris: no, that's not right. There's only one NETWORK SERVICE, not one per machine, and it is only valid locally. If you grant access to NETWORK SERVICE on \\MyFileServer\MyShare, that will allow services running on MyFileServer in the NETWORK SERVICE context to access the share. It will not give access to services running on any other machine on the network. It does not matter which machine you use to change the permissions. To give access to services on MachineA, select MYDOMAIN\MachineA$. In the GUI, use the Object Types option to allow you to select a computer account.
    – Harry Johnston
    Apr 12, 2013 at 6:14
  • @HarryJohnston Nice clarification that the access would be granted to NETWORK SERVICE contexts on MyFileServer, rather than NETWORK SERVICE contexts on MachineA. (And also that it doesn't matter from which machine you set the permissions.) Thanks.
    – Chris
    Apr 17, 2013 at 19:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .